On Mon, Jul 06, 2015 at 03:49:18PM +0200, Mark Wielaard wrote:
On Mon, 2015-07-06 at 09:39 -0400, Josh Boyer wrote:
> On Mon, Jul 6, 2015 at 9:10 AM, Mark Wielaard <mjw(a)redhat.com> wrote:
> >
https://bugzilla.redhat.com/show_bug.cgi?id=1209492 (an to this email)
> > to revert the yama config setting to the upstream default. This fixes
>
> That would make the sysctl file systemd just added on your request
> completely pointless and actually incorrect because changing the value
> wouldn't work at all.
Yes, that is a downside of the patch. You won't be able to switch the
default value anymore. But if we cannot do that by installing the sysctl
file in either the kernel or systemd the alternative would be to hunt
down and fix all individually packages that rely on ptrace working
normally. Which seems unattractive to me if the fix in the kernel is so
simple.
It took some time but we eventually came up with a solution. Stephen
Smalley who added the support for yama originally to the fedora kernel
agrees with the approach. And Paul Moore is making sure this gets merged
upstream. Attached are commits for f22, f23 and master. Please let me know
if you need anything else to get these applied.
Thanks,
Mark